Developer API Documentation

API Documentation

1. Introduction & Architecture
2. Authentication & Keys
3. Idempotency & Replay
4. Orders API
5. Hosted Checkout
6. Payment Status Verification
7. Refund Management
8. Webhook Signatures
9. Error Codes

Version 1.0

API Overview & Base URLs

The TechMights Pay API is built as a RESTful interface using JSON envelopes, standard HTTP status codes, and HTTPS TLS 1.3 encryption.

Environment	Base URL	API Key Prefix	Real Funds Moved?
Sandbox / Test	`https://pay.techmights.com/api/v1`	`tmp_test_key_...`	NO (Simulated Test Mode)
Production / Live	`https://pay.techmights.com/api/v1`	`tmp_live_key_...`	YES (Bank Direct Settlement)

Financial Unit Convention: All transaction amounts in the API are represented in minor currency units (paise for INR). For example, ₹250.00 is submitted as 25000.

Authentication

Authenticate all API requests by passing your public API key and API secret in HTTP headers:

X-Api-Key: tmp_test_key_sample1234567890abcdef

X-Api-Secret: tmp_test_sec_sample_secret_key

Content-Type: application/json

Never expose your X-Api-Secret in client-side code, mobile binaries, or public GitHub repositories.

Create Order API

Create an order before initiating checkout. The response includes a secure checkout_url to redirect your customer.

POST /api/v1/orders

curl -X POST https://pay.techmights.com/api/v1/orders \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "X-Api-Secret: YOUR_API_SECRET" \
  -H "Idempotency-Key: ORD_REQ_10928374" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 50000,
    "currency": "INR",
    "order_reference": "MERCHANT-INV-001",
    "return_url": "https://yoursite.com/checkout/return",
    "customer": {
      "name": "Sunil Varma",
      "email": "sunil@example.com",
      "phone": "+919876500000"
    }
  }'

<?php
$payload = [
    'amount' => 50000, // ₹500.00
    'currency' => 'INR',
    'order_reference' => 'MERCHANT-INV-001',
    'return_url' => 'https://yoursite.com/checkout/return',
    'customer' => [
        'name' => 'Sunil Varma',
        'email' => 'sunil@example.com',
    ],
];

$ch = curl_init('https://pay.techmights.com/api/v1/orders');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($payload),
    CURLOPT_HTTPHEADER => [
        'X-Api-Key: YOUR_API_KEY',
        'X-Api-Secret: YOUR_API_SECRET',
        'Idempotency-Key: ' . bin2hex(random_bytes(16)),
        'Content-Type: application/json',
    ],
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

// Redirect customer to checkout URL
header('Location: ' . $response['data']['checkout_url']);
exit;

const response = await fetch('https://pay.techmights.com/api/v1/orders', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
    'X-Api-Secret': 'YOUR_API_SECRET',
    'Idempotency-Key': 'IDEM_' + Date.now(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    amount: 50000,
    currency: 'INR',
    order_reference: 'MERCHANT-INV-001',
    return_url: 'https://yoursite.com/checkout/return',
  }),
});

const data = await response.json();
console.log('Checkout URL:', data.data.checkout_url);

Sample JSON Response (201 Created)

{
  "success": true,
  "code": "ORDER_CREATED",
  "message": "Order created successfully",
  "data": {
    "order_id": "order_tmp_6f7a8b9c0d1e2f3a",
    "order_reference": "MERCHANT-INV-001",
    "amount": 50000,
    "amount_due": 50000,
    "currency": "INR",
    "status": "created",
    "checkout_url": "https://pay.techmights.com/checkout/order_tmp_6f7a8b9c0d1e2f3a",
    "created_at": "2026-11-06T18:00:00Z"
  }
}

Webhook Signatures & Verification

Every webhook event sent to your webhook URL includes the X-TechMights-Signature header. Verify this header using your secret to confirm payload integrity:

// Signature header format
X-TechMights-Signature: t=1730900000,v1=5d41402abc4b2a76b9719d911017c592...

// Verification in PHP
$receivedHeader = $_SERVER['HTTP_X_TECHMIGHTS_SIGNATURE'];
parse_str(str_replace(',', '&', $receivedHeader), $parts);
$timestamp = $parts['t'];
$expectedSignature = $parts['v1'];

$rawPayload = file_get_contents('php://input');
$computedSignature = hash_hmac('sha256', "{$timestamp}.{$rawPayload}", $webhookSecret);

if (hash_equals($expectedSignature, $computedSignature)) {
    // Signature verified! Process event
}

API Error Codes

Code	HTTP Status	Description
`AUTHENTICATION_REQUIRED`	401 Unauthorized	Missing X-Api-Key or Bearer token header.
`INVALID_CREDENTIALS`	401 Unauthorized	The provided API key or API secret is invalid or revoked.
`LIVE_MODE_RESTRICTED`	403 Forbidden	Live payment processing restricted pending acquiring partner underwriting.
`REFUND_AMOUNT_EXCEEDED`	400 Bad Request	Refund amount exceeds remaining refundable payment balance.